Information processing device controlling analysis of a program being executed based on a result of verification of an analysis program

An information processing device comprising:

• a first interface connected to a host;
• a second interface connected to an investigation computer;
• an interrupt controller configured to generate an interrupt request in response to connection of the investigation computer to the second interface;
• a first memory, the first memory being a volatile memory into which a first program, a second program, and a digital signature for the second program are loaded, the second program and the digital signature being loaded from a third memory of the information processing device, and the third memory being a rewritable and nonvolatile memory that stores the second program and the digital signature;
• a second memory, the second memory being a non-rewritable and nonvolatile memory that stores a third program and a public key, the second memory including a fourth memory and a fifth memory different from the fourth memory, the fourth memory storing the third program, and the fifth memory storing an address value indicating a location of the third program in the fourth memory;
• and
• a processor configured to:
• start execution of the first program;
• receive, from the interrupt controller, the interrupt request during the execution of the first program;
• in response to receiving the interrupt request during the execution of the first program, suspend the execution of the first program and maintain the first program in a suspended state, identify the location of the third program, referring to the address value stored in the fifth memory, and verify, in accordance with the third program, the second program based on the digital signature and the public key;
• when a result of a verification of the second program is found to be a pass, analyze, in accordance with the second program, the first program maintained in the suspended state, and then resume the execution of the first program from a point at which the execution of the first program was suspended;
• and
• when the result of the verification is found to be a fail, refrain from analyzing the first program maintained in the suspended state, and then resume the execution of the first program from the point at which the execution of the first program was suspended.